nats serves the mesh's existing broker certificate #122

2026-09-27T22:07:20Z

jschoubben commented

2026-09-27 22:07:20 +00:00

The module mounted a TLS directory nothing fills, so the server could not start on a mesh that was not raised by the genesis template. The mesh already has a broker certificate every machine pins by fingerprint and the controller trusts; serving the new bus with it means no pin changes when a machine moves, and there is no second certificate to be wrong about. No ca_file: the directory has none, and a pinning client checks the leaf and nothing else.

The module mounted a TLS directory nothing fills, so the server could not start on a mesh that was not raised by the genesis template. The mesh already has a broker certificate every machine pins by fingerprint and the controller trusts; serving the new bus with it means no pin changes when a machine moves, and there is no second certificate to be wrong about. No `ca_file`: the directory has none, and a pinning client checks the leaf and nothing else.

jschoubben added 1 commit 2026-09-27 22:07:21 +00:00

nats serves the mesh's existing broker certificate f1212620e4

The module mounted a TLS directory nothing fills, so the server could not start
on a mesh that was not raised by the genesis template. The mesh already has a
broker certificate every machine pins by fingerprint and the controller trusts;
serving the new bus with it means no pin changes when a machine moves and there
is no second certificate to be wrong about. No ca_file: the directory has none,
and a pinning client checks the leaf and nothing else.

jschoubben merged commit 8e27bc1e36 into main

2026-09-27 22:07:29 +00:00

jschoubben referenced this pull request

2026-09-27 22:16:42 +00:00

nats declares the certificate directory it mounts #123

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#122